3.3 - Perform Security Assessments and Vulnerability Management Activities SSCP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of vulnerability scanning?

   • ATo patch vulnerabilities automatically.
   • BTo assess the security awareness of employees.
   • CTo exploit vulnerabilities to determine their impact.
   • DTo identify known vulnerabilities in systems and applications.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   After a vulnerability scan, a security analyst prepares a report for the IT manager and the system owner. The report includes a list of vulnerabilities with CVSS scores and suggested patches. What is the MOST important additional information to include in the report to support decision-making?

   • AThe names of the vendors that disclosed the vulnerabilities.
   • BThe exact exploit code for each vulnerability.
   • CThe IP addresses of all scanned systems.
   • DThe business impact and asset criticality for each affected system.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is evaluating a new software vendor that will have access to its customer database. The vendor has provided a security policy document and a list of certifications. The company's risk management framework requires a formal supplier risk review. What is the most important factor to consider during this review?

   • AThe vendor's ability to protect the confidentiality, integrity, and availability of the data.
   • BThe vendor's financial stability.
   • CThe vendor's security certifications.
   • DThe vendor's security policies and procedures.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary goal of an internal risk review?

   • ATo guarantee that all risks are eliminated.
   • BTo assign blame for security incidents.
   • CTo replace the need for external audits.
   • DTo evaluate the effectiveness of existing security controls and identify gaps.
   Reveal Solution Discussion Select an answer first
6. 5expert · medium

   An internal risk review of a healthcare organization reveals that patient data is encrypted at rest and in transit, but the encryption keys are stored on the same server as the data. The review team identifies this as a gap. What is the most appropriate recommendation?

   • AAccept the risk because the data is encrypted.
   • BMove the encryption keys to a separate hardware security module (HSM).
   • CEncrypt the keys with a passphrase.
   • DDocument the gap and schedule a review in six months.
   Reveal Solution Discussion Select an answer first